Backdoor detection method and system for quantum neural network
By constructing test samples and performing dimensionality reduction and cluster analysis of the measurement activation matrix, combined with separation index judgment, the problem of poor applicability of quantum neural network backdoor detection is solved, and high reliability and high applicability of backdoor detection are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CENT SOUTH UNIV
- Filing Date
- 2026-01-23
- Publication Date
- 2026-04-28
AI Technical Summary
Existing quantum neural network backdoor detection methods have poor applicability and cannot effectively overcome the limitations of the unobservability of intermediate quantum states and the quantum measurement assumption, resulting in unreliable detection.
By constructing test samples, the expected value of the qubits is obtained to generate the measurement activation matrix. The dimensionality reduction feature matrix is projected using a decomposition function. Cluster analysis is performed using a clustering scheme, and separation indices are calculated to detect backdoors, including unsupervised clustering algorithms and independent component analysis, combined with threshold judgments based on silhouette coefficient and relative clustering coefficient.
It achieves highly reliable and applicable backdoor detection for quantum neural networks, effectively identifying potential backdoor attacks and improving the accuracy and reliability of detection.
Smart Images
Figure CN121935668A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of quantum technology, specifically relating to a backdoor detection method and system for quantum neural networks. Background Technology
[0002] Quantum neural networks are a type of neural network that has experienced rapid development in recent years. They utilize quantum computing as the underlying computational paradigm, employing a quantum-classical hybrid algorithm and parameterized quantum circuits to process quantum states, thereby realizing the functions and applications of neural networks. However, similar to classical deep neural networks, quantum neural networks are also highly vulnerable to backdoor attacks. After being attacked by a backdoor, a quantum neural network may perform normally when processing clean inputs, but may produce malicious predictions when affected by triggers. This situation poses a serious challenge to the reliability and security of quantum neural networks.
[0003] Existing classical defense methods, such as activation clustering and neural cleansing, typically rely on isolating anomalous clusters within the statistical distribution of neuronal activation. However, due to the inherent properties of quantum mechanics, these methods are fundamentally incompatible with quantum neural networks. While some research, such as Q-Detection methods, has attempted to address this issue, these defense methods still cannot completely overcome the unobservability of intermediate quantum states and the limitations imposed by the quantum measurement assumption. Therefore, existing backdoor detection schemes for quantum neural networks have limited applicability. Summary of the Invention
[0004] One of the objectives of this invention is to provide a highly reliable and applicable backdoor detection method for quantum neural networks.
[0005] The second objective of this invention is to provide a system for implementing the backdoor detection method for quantum neural networks.
[0006] The backdoor detection method for quantum neural networks provided by this invention includes the following steps:
[0007] S1. Obtain the quantum neural network to be detected;
[0008] S2. Construct test samples;
[0009] S3. Input the test sample constructed in step S2 into the quantum neural network to be tested, perform measurements to obtain the expected value of each qubit, and generate the corresponding measurement activation matrix;
[0010] S4. Project the measurement activation matrix obtained in step S3 using a decomposition function to obtain the dimension-reduced feature matrix;
[0011] S5. Cluster the reduced feature matrix obtained in step S4 using a clustering scheme;
[0012] S6. Based on the clustering results obtained in step S5, calculate the separation index between the clustering results;
[0013] S7. Based on the separation index obtained in step S6, complete the backdoor detection of the quantum neural network to be detected.
[0014] Step S2, which involves constructing the test sample, specifically includes the following steps:
[0015] Obtain the original clean sample set D and the corresponding original labels. ; Set the attacker's preset target label as ;Set attack mode P to include pixel block trigger attack Frequency-based mixed attacks Set the trigger pattern as follows: The binary mask matrix is The mixing coefficient is ;
[0016] Sample mixing and backdoor injection: based on a preset poisoning rate Select samples from the original clean sample set D. , For sample data, For sample labels; for selected samples ,Will Modified to The backdoor sample was calculated using the following formula. :
[0017] In the formula Fourier transform; This is the inverse Fourier transform; For element-wise multiplication; binary mask matrix The value rule is: the value of an element in the trigger area is 1, and the value of an element outside the trigger area is 0.
[0018] Finally, the generated set The sample is then mixed with the original clean sample that has not been modified to obtain the test sample.
[0019] Step S3, which involves inputting the test sample constructed in step S2 into the quantum neural network to be tested, performing measurements to obtain the expected value of each qubit, and generating the corresponding measurement activation matrix, specifically includes the following steps:
[0020] Each sample in the test sample constructed in step S2 is input into the quantum neural network to be detected to obtain the corresponding output quantum.
[0021] The output quantum is measured using an observable measurement basis, and the expected values obtained from the measurement are used to construct the measurement vector. ;
[0022] The measurement vectors of all samples constitute the measurement activation matrix. , represented as N is the total number of test samples.
[0023] Step S4, which involves projecting the measurement activation matrix obtained in step S3 using a decomposition function to obtain a dimension-reduced feature matrix, specifically includes the following steps:
[0024] An independent component analysis scheme was used to construct the projection matrix. ;
[0025] Using projection matrix Measure the activation matrix Projecting onto a low-dimensional discriminant space yields a dimensionality-reduced feature matrix. for .
[0026] Step S5 involves clustering the reduced-dimensional feature matrix obtained in step S4 using a clustering scheme, specifically including the following steps:
[0027] An unsupervised clustering algorithm is used to process the dimensionality-reduced feature matrix obtained in step S4. Perform cluster analysis;
[0028] In cluster analysis, the following formula is used as the objective function:
[0029] In the formula This represents the total number of clusters. As a membership indicator variable, if the sample Assigned to the In the cluster ,otherwise ; Let be the low-dimensional feature vector of the j-th sample; To represent the first Cluster center / centroid of a cluster.
[0030] Step S6, which involves calculating the separation index between clustering results based on the clustering results obtained in step S5, specifically includes the following steps:
[0031] Based on the clustering results obtained in step S5, the silhouette coefficient is calculated using the following formula. :
[0032] In the formula, N is the total number of test samples; The average intra-cluster distance of sample i1 is the average distance between sample i1 and all other samples in the same cluster to which it belongs. The minimum average inter-cluster distance for sample i1 is the average distance between sample i1 and all samples in the nearest cluster to which it does not belong.
[0033] Based on the clustering results obtained in step S5, the relative clustering coefficient is calculated using the following formula. :
[0034] In the formula This represents the number of samples in a minority cluster (or suspected backdoor cluster); This represents the total number of samples in the test dataset.
[0035] Step S7, which involves detecting the backdoor of the quantum neural network to be detected based on the separation index obtained in step S6, specifically includes the following steps:
[0036] Based on the silhouette coefficients of all clusters obtained in step S6 and relative clustering coefficient The following rules are used for backdoor detection in the quantum neural network to be tested:
[0037] For any cluster If the corresponding contour coefficient Greater than the set threshold and relative clustering coefficient If the value is less than a set threshold, then the cluster is determined. If the cluster is an anomalous backdoor cluster, then the quantum neural network to be tested is determined to have a backdoor.
[0038] Profile coefficients of all clusters All are greater than the set threshold and the relative clustering coefficient If all values are less than the set threshold, it is determined that the quantum neural network to be detected does not have a backdoor.
[0039] This invention also provides a system for implementing the backdoor detection method for quantum neural networks, comprising a network acquisition module, a sample construction module, a matrix generation module, a matrix dimensionality reduction module, a matrix clustering module, an index calculation module, and a backdoor detection module; the network acquisition module, sample construction module, matrix generation module, matrix dimensionality reduction module, matrix clustering module, index calculation module, and backdoor detection module are connected in series; the network acquisition module is used to acquire the quantum neural network to be detected and upload the data information to the sample construction module; the sample construction module is used to construct test samples based on the received data information and upload the data information to the matrix generation module; the matrix generation module is used to input the constructed test samples into the quantum neural network to be detected based on the received data information for measurement to obtain... The expected value of each qubit is calculated, and a corresponding measurement activation matrix is generated. This data is then uploaded to the matrix dimensionality reduction module. The matrix dimensionality reduction module projects the received measurement activation matrix using a decomposition function to obtain a dimensionality-reduced feature matrix, which is then uploaded to the matrix clustering module. The matrix clustering module clusters the received dimensionality-reduced feature matrix using a clustering scheme, and this data is uploaded to the index calculation module. The index calculation module calculates the separation index between clustering results based on the received data and the obtained clustering results, and this data is uploaded to the backdoor detection module. The backdoor detection module performs backdoor detection on the quantum neural network to be detected based on the received data and the obtained separation index.
[0040] The backdoor detection method and system for quantum neural networks provided by this invention, through the construction of test samples and the acquisition, transformation and detection of the output of the test samples for the target quantum neural network, not only achieves backdoor detection for quantum neural networks, but also has higher reliability and better applicability. Attached Figure Description
[0041] Figure 1 This is a schematic diagram of the method flow of the present invention.
[0042] Figure 2 This is a schematic diagram of the functional modules of the system of the present invention. Detailed Implementation
[0043] like Figure 1 The diagram shown is a flowchart of the method of the present invention: The backdoor detection method for quantum neural networks disclosed in this invention includes the following steps:
[0044] S1. Obtain the quantum neural network to be detected;
[0045] S2. Construct test samples; specifically including the following steps:
[0046] Obtain the original clean sample set D and the corresponding original labels. ; Set the attacker's preset target label as ;Set attack mode P to include pixel block trigger attack Frequency-based mixed attacks Set the trigger pattern as follows: The binary mask matrix is The mixing coefficient is ;
[0047] in, , The dimension is the same as that of the input sample x, and it contains the preset trigger pixel value at a specific spatial location; binary mask matrix. The dimension of the input sample x is the same as the dimension of the input sample x. The position of element 1 indicates that the pixel will be triggered by the pattern. Pixel replacement at corresponding positions, where a value of 0 indicates that the pixel of the input sample x is retained;
[0048] Sample mixing and backdoor injection: based on a preset poisoning rate Select samples from the original clean sample set D. , For sample data, For sample labels; for selected samples ,Will Modified to The backdoor sample was calculated using the following formula. :
[0049] In the formula Fourier transform; This is the inverse Fourier transform; For element-wise multiplication; binary mask matrix The value rule is: the value of an element in the trigger area is 1, and the value of an element outside the trigger area is 0.
[0050] Finally, the generated set Mix with the original clean, unmodified sample to obtain the test sample;
[0051] S3. Input the test sample constructed in step S2 into the quantum neural network to be tested, perform measurements to obtain the expected value of each qubit, and generate the corresponding measurement activation matrix; specifically including the following steps:
[0052] Each sample in the test sample constructed in step S2 is input into the quantum neural network to be detected to obtain the corresponding output quantum.
[0053] The output quantum is measured using an observable measurement basis (such as the Pauli-Z basis), and the expected value obtained from the measurement is used to construct the measurement vector. ;
[0054] The measurement vectors of all samples constitute the measurement activation matrix. , represented as N is the total number of test samples;
[0055] The matrix It fully reflects the statistical behavior of the model at the quantum measurement layer and is the sole input source for the detection method, without needing to access the unobservable intermediate states of the quantum circuit; through this process, basic measurement feature data that can be used for subsequent cluster analysis are obtained;
[0056] S4. Project the measurement activation matrix obtained in step S3 using a decomposition function to obtain the dimension-reduced feature matrix; specifically, this includes the following steps:
[0057] An independent component analysis scheme was used to construct the projection matrix. ;
[0058] Using projection matrix Measure the activation matrix Projecting onto a low-dimensional discriminant space yields a dimensionality-reduced feature matrix. for ;
[0059] Independent Component Analysis (ICA) effectively captures the non-Gaussian bias imposed on the measurement distribution by the backdoor trigger, thus significantly improving the separation capability of subsequent clustering. This step concentrates the non-Gaussian bias introduced by the backdoor into a compact representation, making the sample distribution more likely to reveal the potential clustering structure between clean data and backdoor data, thereby facilitating the identification of anomalies. ICA effectively amplifies atypical measurement biases introduced by the backdoor trigger, thus having a significant advantage in detection tasks. The final feature matrix retains the key statistical features of the quantum neural network output while suppressing irrelevant noise, making it easier for potentially anomalous samples to form separate clusters in subsequent clustering steps.
[0060] S5. Cluster the reduced feature matrix obtained in step S4 using a clustering scheme; specifically, the following steps are included:
[0061] An unsupervised clustering algorithm (such as K-Means clustering algorithm) is used to process the dimensionality-reduced feature matrix obtained in step S4. Perform cluster analysis;
[0062] In cluster analysis, the following formula is used as the objective function:
[0063] In the formula This represents the total number of clusters. As a membership indicator variable, if the sample Assigned to the In the cluster ,otherwise ; Let be the low-dimensional feature vector of the j-th sample; To represent the first Cluster center / centroid of each cluster;
[0064] This step can divide the data into subsets, typically identifying the majority of clusters (clean data) and the minority of clusters (suspected backdoor data).
[0065] S6. Based on the clustering results obtained in step S5, calculate the separation index between the clustering results; specifically including the following steps:
[0066] Based on the clustering results obtained in step S5, the silhouette coefficient is calculated using the following formula. :
[0067] In the formula, N is the total number of test samples; The average intra-cluster distance of sample i1 is the average distance between sample i1 and all other samples in the same cluster to which it belongs. The minimum average inter-cluster distance for sample i1 is the average distance between sample i1 and all samples in the nearest cluster to which it does not belong.
[0068] Based on the clustering results obtained in step S5, the relative clustering coefficient is calculated using the following formula. :
[0069] In the formula This represents the number of samples in a minority cluster (or suspected backdoor cluster); The total number of samples in the test dataset;
[0070] S7. Based on the separation index obtained in step S6, complete the backdoor detection of the quantum neural network to be detected; specifically including the following steps:
[0071] Based on the silhouette coefficients of all clusters obtained in step S6 and relative clustering coefficient The following rules are used for backdoor detection in the quantum neural network to be tested:
[0072] For any cluster If the corresponding contour coefficient Greater than the set threshold and relative clustering coefficient If the value is less than a set threshold, then the cluster is determined. If the cluster is an anomalous backdoor cluster, then the quantum neural network to be tested is determined to have a backdoor.
[0073] Profile coefficients of all clusters All are greater than the set threshold and the relative clustering coefficient If all values are less than the set threshold, it is determined that the quantum neural network to be detected does not have a backdoor.
[0074] like Figure 2 The diagram shows the functional modules of the system of this invention: The system for implementing the backdoor detection method for quantum neural networks disclosed in this invention includes a network acquisition module, a sample construction module, a matrix generation module, a matrix dimensionality reduction module, a matrix clustering module, an index calculation module, and a backdoor detection module; these modules are connected in series. The network acquisition module acquires the quantum neural network to be detected and uploads the data information to the sample construction module. The sample construction module constructs test samples based on the received data information and uploads the data information to the matrix generation module. The matrix generation module inputs the constructed test samples into the quantum neural network to be detected based on the received data information. The system performs measurements to obtain the expected value of each qubit and generates a corresponding measurement activation matrix. This data is then uploaded to the matrix dimensionality reduction module. The matrix dimensionality reduction module projects the obtained measurement activation matrix using a decomposition function to obtain a dimensionality-reduced feature matrix, which is then uploaded to the matrix clustering module. The matrix clustering module clusters the obtained dimensionality-reduced feature matrix using a clustering scheme based on the received data, and this data is uploaded to the index calculation module. The index calculation module calculates the separation index between clustering results based on the received data and the obtained clustering results, and this data is uploaded to the backdoor detection module. The backdoor detection module performs backdoor detection on the quantum neural network to be detected based on the received data and the obtained separation index.
Claims
1. A backdoor detection method for quantum neural networks, comprising the following steps: S1. Obtain the quantum neural network to be detected; S2. Construct test samples; S3. Input the test sample constructed in step S2 into the quantum neural network to be tested, perform measurements to obtain the expected value of each qubit, and generate the corresponding measurement activation matrix; S4. Project the measurement activation matrix obtained in step S3 using a decomposition function to obtain the dimension-reduced feature matrix; S5. Cluster the reduced feature matrix obtained in step S4 using a clustering scheme; S6. Based on the clustering results obtained in step S5, calculate the separation index between the clustering results; S7. Based on the separation index obtained in step S6, complete the backdoor detection of the quantum neural network to be detected.
2. The backdoor detection method for quantum neural networks according to claim 1, characterized in that... Step S2, which involves constructing the test sample, specifically includes the following steps: Obtain the original clean sample set D and the corresponding original labels. ; The attacker's preset target label is set as ; The attack mode P is set to include pixel block trigger attack. Frequency-based mixed attacks Set the trigger pattern as follows: The binary mask matrix is The mixing coefficient is ; Sample mixing and backdoor injection: based on a preset poisoning rate Select samples from the original clean sample set D. , For sample data, For sample labels; for selected samples ,Will Modified to The backdoor sample was calculated using the following formula. : In the formula Fourier transform; This is the inverse Fourier transform; For element-wise multiplication; binary mask matrix The value rule is: the value of an element in the trigger area is 1, and the value of an element outside the trigger area is 0. Finally, the generated set The sample is then mixed with the original clean sample that has not been modified to obtain the test sample.
3. The backdoor detection method for quantum neural networks according to claim 2, characterized in that... Step S3, which involves inputting the test sample constructed in step S2 into the quantum neural network to be tested, performing measurements to obtain the expected value of each qubit, and generating the corresponding measurement activation matrix, specifically includes the following steps: Each sample in the test sample constructed in step S2 All of these are input into the quantum neural network to be detected, and the corresponding output quantum is obtained; The output quantum is measured using an observable measurement basis, and the expected values obtained from the measurement are used to construct the measurement vector. ; The measurement vectors of all samples constitute the measurement activation matrix. , represented as N is the total number of test samples.
4. The backdoor detection method for quantum neural networks according to claim 3, characterized in that... Step S4, which involves projecting the measurement activation matrix obtained in step S3 using a decomposition function to obtain a dimension-reduced feature matrix, specifically includes the following steps: An independent component analysis scheme was used to construct the projection matrix. ; Using projection matrix Measure the activation matrix Projecting onto a low-dimensional discriminant space yields a dimensionality-reduced feature matrix. for .
5. The backdoor detection method for quantum neural networks according to claim 4, characterized in that... Step S5 involves clustering the reduced-dimensional feature matrix obtained in step S4 using a clustering scheme, specifically including the following steps: An unsupervised clustering algorithm is used to process the dimensionality-reduced feature matrix obtained in step S4. Perform cluster analysis; In cluster analysis, the following formula is used as the objective function: In the formula This represents the total number of clusters. As a membership indicator variable, if the sample Assigned to the In the cluster ,otherwise ; Let be the low-dimensional feature vector of the j-th sample; To represent the first Cluster centers of each cluster.
6. The backdoor detection method for quantum neural networks according to claim 5, characterized in that... Step S6, which involves calculating the separation index between clustering results based on the clustering results obtained in step S5, specifically includes the following steps: Based on the clustering results obtained in step S5, the silhouette coefficient is calculated using the following formula. : In the formula, N is the total number of test samples; Let i be the average intra-cluster distance of sample i1; Let i be the minimum average inter-cluster distance for sample i1; Based on the clustering results obtained in step S5, the relative clustering coefficient is calculated using the following formula. : In the formula This represents the number of samples in a minority cluster or a suspected backdoor cluster; This represents the total number of samples in the test dataset.
7. The backdoor detection method for quantum neural networks according to claim 6, characterized in that... Step S7, which involves detecting the backdoor of the quantum neural network to be detected based on the separation index obtained in step S6, specifically includes the following steps: Based on the silhouette coefficients of all clusters obtained in step S6 and relative clustering coefficient The following rules are used for backdoor detection in the quantum neural network to be tested: For any cluster If the corresponding contour coefficient Greater than the set threshold and relative clustering coefficient If the value is less than a set threshold, then the cluster is determined. If the cluster is an anomalous backdoor cluster, then the quantum neural network to be tested is determined to have a backdoor. Profile coefficients of all clusters All are greater than the set threshold and the relative clustering coefficient If all values are less than the set threshold, it is determined that the quantum neural network to be detected does not have a backdoor.
8. A system for implementing the backdoor detection method for quantum neural networks as described in any one of claims 1 to 7, characterized in that... It includes a network acquisition module, a sample construction module, a matrix generation module, a matrix dimensionality reduction module, a matrix clustering module, an index calculation module, and a backdoor detection module; these modules are connected in series. The network acquisition module acquires the quantum neural network to be detected and uploads the data to the sample construction module. The sample construction module constructs test samples based on the received data and uploads the data to the matrix generation module. The matrix generation module is used to input the constructed test sample into the quantum neural network to be tested based on the received data information, perform measurements to obtain the expected value of each qubit, generate the corresponding measurement activation matrix, and upload the data information to the matrix dimensionality reduction module. The matrix dimensionality reduction module is used to project the obtained measurement activation matrix using a decomposition function based on the received data information to obtain the dimensionality reduction feature matrix, and then upload the data information to the matrix clustering module. The matrix clustering module is used to cluster the obtained dimensionality-reduced feature matrix according to the received data information and to upload the data information to the index calculation module. The index calculation module is used to calculate the separation index between clustering results based on the received data and the obtained clustering results, and then upload the data to the backdoor detection module. The backdoor detection module is used to detect backdoors in the quantum neural network under test based on the received data and the obtained separation index.